Windows DNS Server CVE-2026-88125

Exploitation requires the target host to be running the Windows DNS Server role and reachable over the network, and the attacker must hold valid low-privilege credentials/authorization (CVSS PR:L) to deliver the malicious DNS traffic - it is not exploitable by a fully unauthenticated remote attacker. Affected builds are specific Windows Server releases below the patched versions (e.g., Windows Server 2022 <10.0.20348.5761, 2019 <10.0.17763.9376, 2016 <10.0.14393.9612, 2025 <10.0.26100.33650, 2012/2012 R2 pre-patch, including Server Core installations). Limiting factors: the required authentication level narrows the attacker population to insiders or those with a foothold, impact is confined to availability (service denial) with no data exposure or code execution, scope is unchanged (S:U), and a vendor patch is available to remediate.

This is a moderate-severity, availability-only vulnerability whose real-world priority is low-to-moderate despite affecting a critical network role. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5) describes a network-reachable, low-complexity attack that requires low-privilege authentication (PR:L) and produces only a denial-of-service impact (A:H) with no confidentiality or integrity loss (C:N/I:N). CISA's SSVC framework reinforces a non-urgent posture: Exploitation=none (no observed or public exploitation), Automatable=no (cannot be reliably mass-exploited), and Technical Impact=partial. No EPSS score was provided in the input and the CVE is not on the CISA KEV list, so there is no public exploitation probability or active-exploitation signal to elevate it. Taken together, the signals are internally consistent - this is a genuine but bounded DoS risk, not a high-urgency compromise vector. One cross-source conflict exists: the input Tags list 'Information Disclosure,' which directly contradicts the CVSS vector's C:N (no confidentiality impact) and the CWE-125 out-of-bounds read that here manifests as a crash/service denial rather than data leakage - verify against the Microsoft MSRC advisory, as the tag appears mislabeled.

An attacker who already holds low-privilege authenticated access on the network sends specially crafted DNS queries or data to a Windows DNS Server, triggering an out-of-bounds read that crashes or hangs the service and denies name resolution to dependent clients. No public exploit code or active exploitation has been identified at time of analysis, and the low attack complexity means a working trigger would be straightforward for an attacker who can reach the service.